Third-Party Risk Management Framework: A 6-Step Guide

By Mike Fitzpatrick

May 2, 2023

By Mike Fitzpatrick · May 2, 2023 · 5 min read

Last updated: November 5, 2026

What is a third-party risk management framework?

A third-party risk management (TPRM) framework is the repeatable process a company uses to identify, assess and reduce the risks that come with outsourcing work to vendors, suppliers and partners. A working framework has six steps: inventory your vendors, tier them by risk, assess them, put security terms in the contract, monitor them, and offboard them cleanly. This guide walks through each step, then gives you a vendor tiering table and a policy outline you can adapt. If you want an independent view of your vendors, our third-party risk assessment service does this work for you.

Why third-party risk management matters

Businesses rely on third parties for IT, marketing, accounting, human resources and much more. Outsourcing cuts cost and improves efficiency, but it moves part of your risk outside your walls. A breach in a vendor’s system can expose your data, and you still answer to your customers.

It protects against data breaches. A framework finds and reduces the security risks a vendor brings, before they become your incident.
It reduces operational risk. A vendor that fails or does not fit how you work can disrupt your operations.
It supports regulatory compliance. Many rules expect you to oversee your vendors. See our summary of the regulatory requirements for third-party risk management.
It protects your reputation. Customers hold you responsible for a vendor’s security failure.

The six steps of a third-party risk management framework

Step 1: Inventory your third parties

You cannot manage vendors you do not know about. Build one list that records, for each vendor: what it does for you, which of your systems and data it touches, who owns the relationship inside your company, and the contract end date. Ask finance for the payments list and IT for the list of connected applications. They rarely match at first.

Step 2: Tier your vendors by risk

Not every vendor deserves the same scrutiny. Tier them by what happens to your business if the vendor is breached or fails. The table below is a typical starting point. Adjust the criteria and review cycle to your own risk appetite.

Tier	Typical criteria	Assessment depth	Typical review cycle
Tier 1: critical	Holds sensitive or regulated data, has privileged access to your systems, or runs a process you cannot do without	Full security questionnaire, evidence review (reports, certifications, test results), and interview	Annually, plus on any incident or major change
Tier 2: important	Handles limited internal data or supports an important but replaceable process	Shorter questionnaire and review of key documents	Every one to two years
Tier 3: low	No access to sensitive data or systems, easily replaced	Basic due diligence at onboarding	At contract renewal

A starting framework, not a standard. Set your own thresholds.

Step 3: Assess the vendor

Before you sign, assess the vendor’s security posture, financial stability and regulatory compliance. For critical vendors, that means a security questionnaire plus proof: independent audit reports, certifications, penetration test summaries and incident history. Where the risk justifies it, add a site visit or a call with their security lead. Match the effort to the tier from Step 2. For a deeper approach to scoring, see our post on vendor risk management scoring.

Step 4: Put security terms in the contract

The contract is where you turn expectations into obligations. For Tier 1 and Tier 2 vendors, cover at least:

Security requirements the vendor must meet, and your right to verify them.
A deadline for telling you about a security incident.
Who may access your data, where it is stored, and who the vendor’s own subcontractors are.
Data return and deletion when the contract ends.
Audit or evidence rights, and how liability is allocated if the vendor causes a breach.

Step 5: Monitor vendors on a schedule

Risk changes after you sign. Monitor vendors at the cadence set by their tier: reassess security, check compliance evidence, review performance and watch for news of breaches or financial trouble. Record findings in your inventory, assign an owner for each issue, and track it to closure. Our guide to developing a comprehensive TPRM program shows how to turn this into a program.

Step 6: Offboard the vendor cleanly

Ending a relationship is a risk event. Cut off access, rotate shared credentials, collect confirmation that your data has been returned or deleted, and update the inventory. Vendors that are removed but still connected are a common blind spot.

Third-party risk management policy: what to include

A TPRM policy turns the framework into rules people follow. It does not need to be long. A policy that works usually has these sections:

Purpose and scope: what the policy covers and which vendors it applies to.
Roles and responsibilities: who owns vendor risk, who approves exceptions, and what the board sees.
Vendor tiering: your criteria, as in the table above.
Onboarding due diligence: what must be done for each tier before a contract is signed.
Contract requirements: the minimum security terms.
Ongoing monitoring: review cycles and triggers for an early review.
Incident notification and response: how vendor incidents are escalated, tied to your incident response plan.
Offboarding: the exit checklist.
Exceptions and review: how exceptions are approved and recorded, and how often the policy itself is reviewed.

For a structured way to organize these controls, NIST’s SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, guides organizations in finding, evaluating and reducing cybersecurity risks across their supply chains.

Do’s and don’ts of managing third-party vendors

Do tie the depth of review to the vendor’s risk, not to how large the vendor is.
Do keep a plan for a vendor incident. Even well-managed vendors have them, so your incident response plan should include vendor scenarios.
Do name an owner inside your company for every critical vendor.
Don’t rely on a vendor’s self-reported questionnaire alone for critical vendors. Ask for evidence.
Don’t treat the assessment as a one-time event at signing.
Don’t forget fourth parties, the subcontractors your vendors depend on.

Frequently asked questions

What are the steps of a third-party risk management framework?

Inventory your vendors, tier them by risk, assess them, put security terms in the contract, monitor them on a schedule, and offboard them cleanly when the relationship ends.

How do you manage third-party vendors?

Start with one list of every vendor and what it can access. Tier the list by risk, spend most of your effort on the critical few, and review them on a set cycle with a named owner for each.

What should a third-party risk management policy include?

Purpose and scope, roles, vendor tiering, onboarding due diligence, minimum contract terms, ongoing monitoring, incident notification, offboarding, and how exceptions and policy reviews are handled. The outline above lists each.

What is the difference between a vendor risk assessment and TPRM?

A third-party risk assessment is one step: evaluating a vendor’s security and compliance. TPRM is the whole program around it, from inventory to offboarding. NCX performs third-party risk assessments for clients who want an independent view.

Next step

If you need help building a TPRM program or assessing your critical vendors, see our third-party risk assessment service or schedule a meeting with our cybersecurity experts.